Senior Application Security Engineer

Duco; Polska; Hybrid; PLN 180,000 - 240,000; Full time

Benefits offered by this job

Private Medical Insurance

Life Insurance

Multisport Program

Unlimited annual holidays

Enhanced family leave

Employee Assistance Programme

Volunteer days off

Referral bonus

Job summary

Duco is seeking an experienced Senior Application Security Engineer to own security across the SDLC and CI/CD pipelines. You will manage the ASPM platform, Ox Security, and translate findings into effective remediation with engineering teams.

You will lead threat modelling, secure design reviews, and promote secure coding practices across Engineering, while collaborating with the GRC and SI teams. This role is based in a distributed team across London and Wrocław.

Qualifications

• 7+ years in an application security, product security or DevSecOps role, ideally in SaaS.
• Hands-on experience integrating security tooling into CI/CD pipelines.
• Ability to translate findings into prioritized remediation actions.
• Strong understanding of vulnerability classes and OWASP Top 10 with practical remediations.
• Ability to read and review code in Java, Ruby or Python.
• Experience with threat modelling alongside engineering teams.
• Working knowledge of AWS and IaC.
• Proficiency in Python or similar scripting for automation.
• Credibility with developers and ability to influence risk discussions.
• Hands-on experience with ASPM/ Ox Security or similar.
• Background in software engineering prior to security.
• Experience with software supply chain security (SLSA, SBOMs, artefact signing).
• Container and Kubernetes security experience including image scanning and admission controls.
• Experience with policy-as-code tooling.
• Experience establishing security champions programme.
• Experience securing LLM/agentic AI capabilities with OWASP Top 10 for AI apps.
• Familiarity with financial regs such as DORA, ISO27001, SOC 2.
• Certifications such as OSWE, GWAPT, CSSLP or AWS Certified Security – Specialty.

Responsibilities

• Secure SDLC and pipeline security across CI/CD, embedding secure delivery as default.
• Build and maintain pipeline security guardrails (SAST, SCA, secrets scanning, IaC and container scanning).
• Strengthen software supply chain security (SBOMs, build provenance).
• Define pre-deployment cloud guardrails with policy-as-code.
• Own Ox Security ASPM platform: tune policies, reduce noise and prioritize findings.
• Drive remediation with engineering leads and SLAs, report progress.
• Coordinate application penetration testing and remediation tracking.
• Lead threat modelling for new features and major architectural changes.
• Conduct secure design reviews and promote secure coding practices via guidance and security champions.
• Represent platform security in client reviews and audits; report security metrics.
• Monitor emerging threats including AI/agentic capabilities.

Skills

CI/CD security tooling

Application security

Threat modelling

OWASP Top 10

Code review (Java, Ruby, Python)

AWS & IaC

Python scripting

Security champions network

LLM security

SLSA / SBOM

Container & Kubernetes security

Policy-as-code

Tools

SAST

SCA

Secrets scanning

IaC scanning

Container image scanning

Policy-as-code tooling

Ox Security platform

Job description

The opportunity

We are seeking an experienced Senior Application Security Engineer to take ownership of security across our software development lifecycle (SDLC). In this role, you will establish secure delivery as the default for our engineering teams, from design and code through to the pipelines that release it.

You will own our Application Security Posture Management (ASPM) platform, Ox Security, and ensure its findings translate into effective remediation. This includes reducing noise, prioritising vulnerabilities that are genuinely exploitable and partnering closely with engineering teams to resolve them. You will also define our approach to threat modelling, security testing and the integration of security guardrails into our CI/CD pipelines.

You will join a small, collaborative Information Security team based across London and Wrocław, working alongside our Senior Security Engineer (Cloud & SecOps) and our Governance, Risk and Compliance (GRC) function. You will work closely with our Engineering teams on a day-to-day basis and report to the Head of Information Security.

Key responsibilities

Secure SDLC and pipeline security

• Own security across our SDLC and CI/CD pipelines, embedding secure delivery as the default
• Build and maintain pipeline security guardrails, including static application security testing (SAST), software composition analysis (SCA), secrets scanning, and infrastructure-as-code (IaC) and container image scanning, with gating policies agreed with Engineering
• Strengthen software supply chain security, including dependency hygiene, software bills of materials (SBOMs) and build provenance
• Define pre-deployment cloud guardrails through policy-as-code, in partnership with our Senior Security Engineer (Cloud & SecOps)

Vulnerability management and remediation

• Own Ox Security as our ASPM platform, including policy tuning, noise reduction and the prioritisation of findings based on reachability and exploitability
• Drive remediation with engineering teams, agreeing remediation service level agreements (SLAs) with engineering leads and reporting clearly on progress
• Scope and coordinate application penetration testing, tracking findings through to remediation

Secure design and engineering enablement

• Lead threat modelling for new features and significant architectural changes
• Conduct secure design reviews and review high-risk code changes
• Promote secure coding practices through practical guidance, training and a security champions network across Engineering

Client assurance, reporting and threat awareness

• Represent our platform security with confidence in client security reviews and due diligence discussions, alongside the Head of Information Security
• Maintain and report application security metrics that inform risk reporting and key risk indicators (KRIs)
• Support audits and client assurance activities with clear evidence of our secure development and release practices
• Monitor emerging application and supply chain threats, including those affecting AI and agentic capabilities

Skills and experience

• Proven experience in an application security, product security or DevSecOps role, ideally within a SaaS environment (7+ years)
• Hands-on experience integrating security tooling into CI/CD pipelines
• A track record of converting SAST, SCA, secrets or ASPM findings into prioritised, remediated work rather than raw reporting
• Strong understanding of common vulnerability classes and the OWASP Top 10, with practical knowledge of how to remediate them
• The ability to read and review code in at least one of our core languages: Java, Ruby or Python
• Experience facilitating threat modelling with engineering teams
• Working knowledge of AWS and infrastructure-as-code
• Proficiency in Python or a comparable scripting language for automation
• Credibility with developers, with the ability to influence engineering teams and articulate risk in actionable terms
• Hands-on experience with Ox Security or another ASPM platform
• A background in software engineering prior to moving into security
• Software supply chain security experience, such as Supply-chain Levels for Software Artifacts (SLSA), SBOMs or artefact signing
• Container and Kubernetes security experience, including image scanning and admission controls
• Experience with policy-as-code tooling
• Experience establishing a security champions programme
• Experience securing large language model (LLM) or agentic AI capabilities, such as applying the OWASP Top 10 for LLM Applications
• Familiarity with financial services regulations and standards, such as the Digital Operational Resilience Act (DORA), ISO 27001 and SOC 2
• Relevant professional certifications, such as OSWE, GWAPT, CSSLP or AWS Certified Security – Specialty

The reward package

• Competitive salary package aligned with your skills and experience, reviewed annually.
• Success Share bonus payments.
• Private Medical Insurance – Enel Med.
• Life Insurance.
• Multisport Program.
• Unlimited annual holiday, because we trust our people to manage their own time off.
• Enhanced family leave.
• Employee Assistance Programme.
• 4 volunteering days off.
• Referral bonus if we hire someone great who you've recommended to us.